Matter note: AML obligations for a virtual-asset service provider

Virtual-asset service providers entering the Hong Kong market face a compliance architecture that moves faster than most incoming operators expect. The Anti-Money Laundering and Counter-Terrorist Financing Ordinance establishes the AML baseline. The mandatory licensing regime under that Ordinance – administered by the Securities and Futures Commission as the licensing authority – adds a second layer. When the operator comes from outside Hong Kong, a third layer appears: the cross-border origination of customers, transaction flows and source-of-funds documentation. The combination is rarely straightforward.

A centralised virtual-asset trading platform operating across Greater China and Southeast Asia must hold a licence from the Securities and Futures Commission under the mandatory virtual-asset trading platform licensing regime, which commenced on 1 June 2023, and must simultaneously satisfy the Anti-Money Laundering and Counter-Terrorist Financing Ordinance's customer due diligence and travel-rule obligations. Failure to satisfy either strand independently is a licensing disqualifier.

This matter note describes how we worked through that combination for an operator whose compliance programme had been built for a different regulatory environment. The jurisdictions engaged were Hong Kong, a Southeast Asian home market and the Cayman Islands, where the group's principal holding entity was incorporated. The note is fully anonymised. No client-identifying information, no counterparty names and no transaction figures appear.

What was the situation, and why did it create a compliance constraint?

A mid-market virtual-asset trading group came to our desk in a position that is, in our experience, common among operators scaling into Hong Kong from other Asia-Pacific markets. The group had built a capable technical platform and a customer base concentrated across two Southeast Asian jurisdictions. Its Cayman holding entity sat above a Hong Kong-incorporated operating subsidiary that had been running in a pre-licensing environment. The group had not, at that point, applied to the Securities and Futures Commission for a virtual-asset trading platform licence.

The constraint was structural rather than deliberate. The group's AML programme had been designed around the regulatory requirements of its home market. Those requirements were real and had been met. They were not, however, calibrated to the Anti-Money Laundering and Counter-Terrorist Financing Ordinance or to the Securities and Futures Commission's licensing conditions. Three gaps became apparent almost immediately once we reviewed the programme.

First, the customer due diligence procedures did not align with the Ordinance's risk-based requirements for virtual-asset customers. The existing programme applied a relatively uniform onboarding process. The Ordinance requires a risk-calibrated approach, with enhanced due diligence triggered by defined categories of customer and transaction. Second, the group had not implemented the FATF travel rule (the Financial Action Task Force requirement that originator and beneficiary information travels with a virtual-asset transfer) in a form that the SFC's licensing conditions would accept. The technical capability existed; the procedural and record-keeping architecture did not. Third, the compliance function had no documented procedure for handling cross-border customer flows where source-of-funds documentation from the Southeast Asian home market could not be readily obtained in the form Hong Kong examiners would expect.

Each gap was individually manageable. The combination, presented to an SFC licence examiner without a remediation narrative, would have been difficult to explain.

What was the specific legal issue, and which route did we recommend?

The core issue was that the group's AML obligations in Hong Kong were governed by the Anti-Money Laundering and Counter-Terrorist Financing Ordinance from the date its Hong Kong-incorporated subsidiary became a virtual-asset service provider (a regulated entity conducting virtual-asset services as defined in the Ordinance) – not from the date a licence was formally granted. The obligation attached to the activity, not only to the licence status.

This is a point that foreign counsel often misread. The licensing obligation and the AML obligation are parallel, not sequential. A group cannot defer AML compliance until the licensing application is submitted. The Ordinance applies to the regulated activity from the point at which it is carried on. Our desk regularly sees incoming operators who have approached the licensing question as a precondition to everything else; the sequence is wrong.

The route we recommended had two elements running in parallel. First, a compliance remediation exercise to bring the AML programme to the standard required by the Ordinance and the SFC's licensing conditions, with a documented gap analysis and a timed implementation plan. Second, the preparation of the licensing application itself, structured so that the remediation narrative was integrated into the application rather than appended as an afterthought. The SFC's examination process for virtual-asset trading platform licences is substantive. An application that acknowledges and addresses a prior gap coherently is more defensible than one that presents a programme as if no gap existed.

The cross-border interface shaped both elements. The group's Southeast Asian customer base meant that the enhanced due diligence procedures had to work for customers whose identity documents, address verification and source-of-funds materials were issued by jurisdictions outside Hong Kong. The travel-rule implementation had to cover transfer flows between the Hong Kong platform and counterpart platforms in jurisdictions that had adopted the FATF travel rule at varying stages. Neither question had a purely technical answer; both required documented procedures that a compliance examiner could test against the Ordinance's standards.

The sequence above describes the standard position. Your matter turns on the documents, the jurisdictions actually engaged, and the order of steps – which is where the route is won or lost.

To discuss how the Anti-Money Laundering and Counter-Terrorist Financing Ordinance applies to your virtual-asset operation across the relevant jurisdictions, contact info@lockhartyip.com.

How did the sequence run, and where was the turning point?

We began with a structured review of the existing AML programme against the Ordinance's requirements and the SFC's published licensing conditions. The review was documentary: we worked from the group's internal AML policy, its customer onboarding procedures, its transaction-monitoring parameters and its record-keeping architecture. The group's compliance team participated directly. The output was a written gap analysis with each identified deficiency categorised by materiality and by the time and resource required to remediate it.

The travel-rule gap was the most technically involved. The group's platform had the capability to attach originator and beneficiary information to outbound transfers. The gap was in the inbound direction: the platform did not have a consistent procedure for handling inbound transfers where the originating platform had not transmitted the required information. The Ordinance and the SFC's guidance both require a defined procedure for this situation. We worked with the group's technology and compliance teams to document a protocol: a risk-based decision tree that applied enhanced scrutiny to unhosted-wallet transfers and to transfers from platforms operating in jurisdictions assessed as higher risk for travel-rule compliance. The protocol was documented in the AML policy and reflected in updated transaction-monitoring parameters.

The customer due diligence procedures required less technical work but more procedural documentation. The group's onboarding flow was substantively sound. The gap was in the written procedure: the triggers for enhanced due diligence were not clearly defined, the escalation path for politically exposed persons was not documented at the required level of specificity, and the procedure for cross-border source-of-funds verification had not been reduced to a step-by-step process that a compliance officer in Hong Kong could follow for customers domiciled in the Southeast Asian home market.

The turning point came when we aligned the remediation timeline with the licensing application timetable. An earlier, separate filing attempt had stalled because the compliance documentation had been prepared after the application was submitted; the examiner's questions arrived before the documentation was complete. We re-sequenced: the remediation work ran first; the application was submitted once the gap analysis was closed and the updated procedures had been in operation for a documented period. The application included a chronological remediation narrative – what the gap was, when it was identified, what was done, and when the remediated programme became operational.

That narrative is, in our view, the single most important structural element for an operator whose programme has a documented prior state that differs from its current state. Examiners expect evolution. What they require is a coherent account of it.

If an earlier filing, structure or enforcement attempt produced an adverse or stalled result, a second read can identify the strategic error and the routes still open. Write to info@lockhartyip.com to discuss the position.

What was the outcome, and what is the transferable lesson?

The qualitative outcome was that the licensing application advanced through the SFC's examination process without a second round of material compliance questions on the AML programme. The travel-rule protocol and the enhanced due diligence procedures were reviewed and accepted as part of the examination. The group's compliance team was able to manage subsequent examiner questions from a documented baseline rather than reconstructing the rationale for individual decisions under examination pressure.

The broader point is structural. Virtual-asset service providers scaling into Hong Kong from other Asia-Pacific markets should treat the AML obligation and the licensing obligation as co-primary requirements from the date regulated activity begins – not as a staged sequence in which licensing leads and AML follows. The Anti-Money Laundering and Counter-Terrorist Financing Ordinance attaches obligations to the activity. The Securities and Futures Commission, as the licensing authority, will examine both in parallel.

The cross-border dimension is not an optional consideration for most operators. Where a platform's customer base spans multiple jurisdictions, the AML programme has to function across the customer documentation formats, source-of-funds verification routes and travel-rule compliance levels of all jurisdictions served. A programme designed for a single home market will have identifiable gaps when read against the Ordinance's standards. Identifying and closing those gaps before an examiner does is not a formality – it is the substance of the exercise.

A second transferable lesson concerns the Cayman holding structure. The group's Cayman holding entity sat above the Hong Kong operating subsidiary. The Cayman entity itself was subject to the Cayman Islands' own economic-substance and AML regimes. The interface between the two layers – particularly in relation to group-level AML policies and governance responsibilities – required documentation at the Hong Kong level to show that the Hong Kong subsidiary's AML programme operated independently and met the Ordinance's requirements, rather than simply deferring to a group policy designed for a different environment. Where an operator relies on a group AML policy written for offshore or other jurisdictions, that reliance will be tested by the SFC examiner against the local standard.

In our cross-border practice, we see this holding-structure issue arise regularly. The solution is not to abandon the group policy. It is to document clearly the ways in which the Hong Kong operating subsidiary's programme meets the local standard, and where it exceeds or supplements the group baseline.

Common misconceptions that complicate the licensing process

A number of misconceptions surface regularly when operators approach the Hong Kong virtual-asset licensing process from outside the jurisdiction. Three are worth addressing directly, because each has the potential to delay or complicate an otherwise viable application.

The first misconception is that licensing is primarily a documentation exercise. It is not. The Securities and Futures Commission's examination of a virtual-asset trading platform licence application includes a substantive review of the applicant's AML programme, governance structures, technology controls and responsible officers. An application built on a compliance programme that cannot withstand substantive examination will stall regardless of how well the documentation is assembled. The documentary record matters because it evidences the programme; the programme itself is the primary subject of examination.

The second misconception is that travel-rule compliance is a technology question only. The FATF travel rule for virtual-asset transfers has a technical dimension – the platform must be capable of attaching and receiving the required information – but it also has a procedural and governance dimension. What does the platform do when a counterpart platform does not transmit the required information? What risk assessment governs transfers to or from unhosted wallets? How are those decisions documented and escalated? The Ordinance and the SFC's published guidance both require answers to these procedural questions in writing. Technology capability alone is not sufficient.

The third misconception concerns the territorial scope of the Ordinance. Some operators assume that because their customer base is concentrated outside Hong Kong, the Ordinance's requirements apply only to their Hong Kong-connected transactions. This is a misreading. The Ordinance applies to the regulated entity – the Hong Kong-incorporated subsidiary or the entity conducting regulated activity in Hong Kong – without carving out obligations for transactions with non-Hong Kong customers. The AML programme must cover all customers and transactions of the regulated entity, including cross-border flows.

Each of these misconceptions, if left uncorrected, produces identifiable examination risk. Our desk addresses each in the gap-analysis stage, before the application is submitted.

Related practices

• Tech & Web3 – virtual-asset licensing, AML compliance and cross-border regulatory positioning
• Sanctions & AML – AML programme review, sanctions compliance and source-of-funds structuring

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

Related

• Tech Web3
• Data Transfer Privacy Terms Asia Facing Platform
• Token Issuance Reviewed Under Hong Kong S Regime 3

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.